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Claims 

1. A method for detecting events in a system, the method comprising 
the steps of: 

(a) providing a mapping between each of a plurality of groups of 
possible observable events and one of a plurality of likely corresponding events 
in said system; 

(b) monitoring said observable events and detecting one or more 
known observable events generated by said system; 

(c) determining a mismatch measure between each of the plurality of 
groups of possible observable events in said mapping and said one or more 
known observable events using a computer, while disregarding observable 
events in the groups of possible observable events not determined to be known; 
and 

(d) selecting one or more of said plurality of likely events 
corresponding to one of said plurality of groups having the smallest mismatch 
measure. 

2. The method of Claim 1 wherein said likely corresponding events 
comprise problems. 

3. The method of Claim 1 wherein said computer-accessible mapping 
comprises a codebook. 

4. The method of Claim 1 wherein said mapping is deterministic. 

5. The method of Claim 1 wherein said mapping is probabilistic. 

6. The method of Claim 1 wherein said mismatch measure comprises 
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7. The method of Claim 1 wherein said mapping is computer 
accessible. 

8. A method for detecting events in a system, the method comprising 
the steps of: 

(a) providing a mapping between each of a plurality of groups of 
possible symptoms and one of a plurality of likely events in said system; 

(b) assigning a value of unknown to all of said possible symptoms in 
said mapping; 

(c) monitoring said symptoms and detecting one or more known 
symptoms generated by said system; 

(d) assigning a value of known to said possible symptoms in said 
mapping corresponding to said one or more known symptoms; 

(e) determining a mismatch measure between each of the plurality of 
groups of possible symptoms having a value of known in said mapping and 
said one or more known symptoms using a computer, while disregarding 
symptoms in the groups of possible symptoms having a value of unknown; and 

(f) selecting one or more of said plurality of likely events 
corresponding to one of said plurality of groups having the smallest mismatch 
measure. 

9. The method of Claim 8 further comprising repeating steps (c)-(f) 
periodically. 

10. The method of Claim 8 further comprising repeating steps (b)-(f) 
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periodically. 

11. The method of Claim 8 wherein step (b) comprises assigning a high 
loss probability value to said symptoms. 

12. The method of Claim 8 wherein step (d) comprises assigning a low 
loss probability value to said symptoms. 

13. The method of Claim 8 wherein said likely events comprise 
problems. 

14. The method of Claim 8 wherein said computer-accessible mapping 
comprises a codebook. 

15. The method of Claim 8 wherein said mapping is deterministic. 

16. The method of Claim 8 wherein said mapping is probabilistic. 

17. The method of Claim 8 wherein said mismatch measure comprises 
a Hamming distance. 

18. The method of Claim 8 wherein said mapping is computer 
accessible. 

19. A method for detecting problems in a system that generates a 
plurality of symptoms, the method comprising the steps of: 

(a) providing a computer-accessible codebook comprising a matrix of 
values each corresponding to a mapping between one of a plurality of said 
possible known and unknown symptoms and one of a plurality of likely events 
in said system; 

(b) associating a loss probability of about 100% with all unknown 
symptoms in the codebook; 
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(c) monitoring a plurality of symptom data values representing a 
plurality of known symptoms generated by said system over time; 

(d) decreasing the loss probability for symptoms in the codebook that 
have been received; 

(e) determining a mismatch measure between each of a plurality of 
groups of said values in said codebook and said plurality of known symptom 
data values through the use of a computer, said mismatch measure taking into 
account the loss probability of symptoms; and 

(f) selecting one of said plurality of likely events corresponding to one 
of said plurality of groups having the smallest mismatch measure. 

20. A apparatus for detecting events in a system, the apparatus 
comprising: 

a storage device for storing a computer-accessible mapping between each 
of a plurality of groups of possible observable events and one of a plurality of 
likely corresponding events in said system; 

means for monitoring said observable events and detecting one or more 
known observable events generated by said system; 

means for determining a mismatch measure between each of the plurality 
of groups of possible observable events in said mapping and said one or more 
known observable events using a computer, while disregarding observable 
events in the groups of possible observable events not determined to be known; 
and 

means for selecting one or more of said plurality of likely events 
corresponding to one of said plurality of groups having the smallest mismatch 
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measure. 

21. A computer program product in computer-readable media for 
detecting events in a system using a computer-accessible mapping between each 
of a plurality of groups of possible observable events and one of a plurality of 
likely corresponding events in said system, the computer program product 
comprising instructions for causing a computer to: 

monitor said observable events and detect one or more known observable 
events generated by said system; 

determine a mismatch measure between each of the plurality of groups of 
possible observable events in said mapping and said one or more known 
observable events using a computer, while disregarding observable events in 
the groups of possible observable events not determined to be known; and 

select one or more of said plurality of likely events corresponding to one 
of said plurality of groups having the smallest mismatch measure. 
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